Report vulnerabilities privately rather than opening a public issue. Email the maintainer listed in CODEOWNERS with a description and reproduction steps. Expect an initial response within a few business days.